Hack In The Box Security Conference Courses

Breaking Web3 - Exploitation Techniques for Cryptocurrency Hacking

Explores exploitation techniques for cryptocurrency hacking across vulnerable Web3 infrastructure, nodes, transaction flows, private keys, and ERC20 smart contracts.

• YouTube
• 57 minutes
• Self-Paced
• Conference Talk

One-Click to Completely Takeover a MacOS Device

A vulnerability chain bypasses macOS security protections on Apple Silicon and Intel devices, demonstrated from one-click execution to complete takeover.

• YouTube
• 52 minutes
• Self-Paced
• Conference Talk

EDR Evasion Primer for Red Teamers

Explores EDR internals and demonstrates Windows API injection, function unhooking, and custom syscall techniques for evasion.

• YouTube
• 1 hour 2 minutes
• Self-Paced
• Conference Talk

Exploiting a Limited UAF on Ubuntu 22.04 to Achieve LPE

Explore reliable Linux kernel exploitation techniques for turning a limited use-after-free vulnerability into root privilege escalation on Ubuntu 22.04.

• YouTube
• 57 minutes
• Self-Paced
• Conference Talk

E'rybody Gettin' TIPC - Demystifying Remote Linux Kernel Exploitation

A walkthrough of discovering and exploiting a remote stack overflow in a Linux kernel network module, revealing the low-level exploit development process.

• YouTube
• 54 minutes
• Self-Paced
• Conference Talk

Attacking WPA3 - New Vulnerabilities And Exploit Framework

Examines newly discovered WPA3 and Management Frame Protection vulnerabilities, including client-disconnection and router-crash attacks, with proof-of-concepts in a Wi-Fi testing framework.

• YouTube
• 1 hour 2 minutes
• Self-Paced
• Conference Talk

Exploiting Race Condition Vulnerabilities in Web Applications

Explore how race conditions and TOCTOU flaws arise in web applications and how attackers test them through live demos and a distributed penetration-testing tool.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Getting Clear Text Passwords From An IdP & More

A cybersecurity research talk on using knowledge graphs for trust analysis to uncover identity-platform privilege escalation and impersonation weaknesses.

• YouTube
• 33 minutes
• Self-Paced
• Conference Talk

Advanced Code Obfuscation With MBA Expressions

Explore Mixed Boolean-Arithmetic transformations for building obfuscation primitives, from opaque predicates to virtualization-based VM handlers.

• YouTube
• 1 hour 52 minutes
• Self-Paced
• Conference Talk

Cracking Kyocera Printers

A deep dive into Kyocera printer vulnerabilities, including pre-authentication remote code execution, arbitrary file reading, password leakage, and office-network compromise.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Simulating Execution in Malicious Text Detection

Examines how simulated execution can improve malicious-text detection against obfuscation while reducing false positives and addressing dynamic-analysis trade-offs.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Web3 + Scams = It's A Match

An examination of 35 cryptocurrency scam types, from familiar pump-and-dump schemes to Web3-specific rug pulls and NFT airdrop scams.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

Template Injection on Hardened Targets

Explores server-side template injection against hardened Flask/Jinja2 and Express/Vue environments using Python tooling and progressively difficult challenges.

• YouTube
• 1 hour 33 minutes
• Self-Paced
• Conference Talk

Building an Army of Bots by Hijacking a Twitter Handle

Examines how hardcoded Twitter API credentials in mobile apps enable account takeover, bot activity, and sensitive actions, and how to prevent such leaks.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Faking at Level 1 - How Digital Twins Save Your PLCs

Learn how virtualized digital twins of PLCs and other OT devices can safely reproduce industrial networks for vulnerability research and penetration testing.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk